DNS-over-HTTPS and private DNS: stopping the part of your browsing everyone can see

HTTPS encrypts what you send to a website, but it does not hide which websites you ask for. That lookup — turning a name like a bank into an address — traditionally happens in plain DNS, visible to your ISP, the café Wi-Fi, and anyone watching the network. Encrypted DNS closes that gap, and it is one of the easiest privacy wins available.

The leak it fixes

As explained in what DNS is, every site you visit starts with a DNS query, and in the old model that query is unencrypted. So even though the contents of your banking session are private, the fact that you visited your bank is not — and on public Wi-Fi that list is trivially readable. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) wrap those lookups in encryption, so the network sees that you are using DNS but not the names.

How to turn it on

It is built into modern systems: browsers and operating systems now have a "secure DNS" or "private DNS" setting, and Android calls it Private DNS. Enable it and point at a reputable resolver. If it seems to break something, the cause is usually a network that expects to intercept DNS — the troubleshooting is the same ground as private DNS not working and DNS problems diagnosed.

What it does not do

Be honest about the limits. Encrypted DNS hides your lookups from the network, but the resolver you choose can now see them — so you are moving trust from your ISP to your DNS provider; pick one with a clear no-logging policy. It does not hide your traffic from the websites themselves (that is what a VPN is for), and it does not make you anonymous. It is one specific, worthwhile layer: stop the network reading your browsing list. Combined with browser privacy settings, it removes a surprising amount of casual surveillance for a two-minute change.

Sources

• Cloudflare — DNS over HTTPS